]> git.ipfire.org Git - thirdparty/glibc.git/commit
syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)
authorArjun Shankar <arjun@redhat.com>
Mon, 15 Jan 2024 16:44:44 +0000 (17:44 +0100)
committerArjun Shankar <arjun@redhat.com>
Tue, 30 Jan 2024 14:57:01 +0000 (15:57 +0100)
commit2bc9d7c002bdac38b5c2a3f11b78e309d7765b83
tree83bd1e607b03e1b951d303120663826419898942
parentd1a83b6767f68b3cb5b4b4ea2617254acd040c82
syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)

__vsyslog_internal used the return value of snprintf/vsnprintf to
calculate buffer sizes for memory allocation.  If these functions (for
any reason) failed and returned -1, the resulting buffer would be too
small to hold output.  This commit fixes that.

All snprintf/vsnprintf calls are checked for negative return values and
the function silently returns upon encountering them.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
(cherry picked from commit 7e5a0c286da33159d47d0122007aac016f3e02cd)
misc/syslog.c